Pop up/under ad(s) causing Anti-Virus application to be set off.

First topic message reminder :

I haven't reported anything with the scam pop-up ads for a while as the first time around it did not go well. I've been mostly keeping a record of the pop-up ads otherwise I'm just ignoring them and quickly closing them out. However, I can't ignore the scam pop-up ad if it's setting the Anti-virus program (AVG) off. Said event just happened today as I was about to update some post.

- Your country: USA
- Date and time when the ad appears: August 22, 2019, 3:52 PM HAST.
-Type: (Pop up, banner top, Banner bottom) Pop up
- Where you logged in to the forum: Yes
- Device and version: macOS High Sierra  V.10.13.6
- Browser and version: Firefox V. 68.0.2
-  URL of the ad:

Code:

https://www.instantreward.site/dir/gift/iphone/en/?city=Honolulu&country=United States&os_name=Mac OS X&os_version=10.13&clickid=6bf2dfnfyg5ibi424d&trafficsource=21&lpkey=15f866f8520e52d359&campaign=2347&uclick=fnfyg5ibi4

- Image location (if applicable):
- Screenshot(s) of the Ad: Blocked thanks to AVG, You can see what happened to the pop up site in the background of the AVG screenshots.
- Comments:
Anti-virus program (AVG) Screencaps:

Spoiler:

no, I mean I cannot even view the forum

Would you be able to attach a screenshot of what you are experiencing?

Regards,
Chanel

I found nothing wrong here

I’m unsure if you’re aware but just in case you can access the administration panel through https://www.forumotion.com/utils.

I do not see anything malicious on your forum, is there a way to dismiss the warning?

Regards,
Chanel

your forum loads also fine with Kaspersky 

did this happen after the last update of Eset at 30.08.2018?

this is probably a problem coming from Eset https://forum.eset.com/topic/16621-jsadwareagentaa-application-pops-up-when-i-want-to-enter-kissanime/

https://sitecheck.sucuri.net/
https://rescan.pro/
https://www.siteguarding.com/

"Known javascript malware"

If some links are not a part of your website or blacklisted. You need to remove them from your website to avoid any penalties from Google.
Element
Reason
HTML JavaScript code
JavaScript virus injection Reason: Long coded fromCharCode Code: 'currentScript','slice','toString','random','iframe','createElement','document','position','style','
HTML JavaScript code
JavaScript virus injection Reason: load .php Code: http://deloplen.com/apu.php?zoneid=2827263
HTML JavaScript code
JavaScript virus injection too many \x
HTML JavaScript code
JavaScript virus injection too many %

if i go to that link in the quote, eset blocks the page.
if you put that link into virustotal.com - it just says No matches found!
like virustotal cannot access the page. that page is probably blocking virustotal.com via .htaccess or something.

if you put the base url into virustotal, then you get this...
https://www.virustotal.com/gui/domain/deloplen.com/details
which does not look like a good result.

Hello,

We recently switched to a new advertising agency in order to try and get rid of the bad ads, but if you still find any, feel free to report them to us.

In the meantime, you should add your forum to your antivirus's whitelist to prevent it from being blocked.

-Brandon

This problem looks to be the same kind of thing as this thread
https://help.forumotion.com/t157846-pop-up-under-ads-causing-anti-virus-application-to-be-set-off

I am going to  merge the two topic's and mark it as only topic

I can access my forum again now...

but if I click to accept cookies or login I still get a popup from the page which leads to "infected" sites.

We are still working on the problem and the progress is still pending so this means we have not yet fixed the problem but we will be looking in to the problems with the ad's

Hello

We have asked out Ad's provider to make some change to our ad's
Please can you make sure you report any other ad's you may have that look bad to you.

We hope this change has not stopped the problems.

Regards.

Forumotion Team

today i received the same threat in my forum (https://keeponblogging.forumgreek.com/)

Thank you for your report i will let our head office know

This ads hosted by oukruque.com just came to my site and Safe Browsing immediately sent me a warning look like this


Here is a detail report from Google

just an update i still get the same message from my forum every time i visit it

I had the same problem yesterday

Thank you I have passed this topic on to our team again and they will take a look as soon as they can.

I had issues too on my forum today ( and that was not the first time) I hoped it was solved by now when I red the topics but it seems even worse
before it was on logging in, now it is after logging in when I click the index of the forum it redirects to anothers site and opens a new tab in the browser, it was direct blocked by malwarbytes :

As I was checking my site and this topic I got a fake flash update site. Yuck! I think it would have redirected me off my forum site if it won't for some firefox setting that forced it into a new tab.

-site: http://friendlyforest.forumotion.com/
- Your country: USA
- Date and time when the ad appears: October 9, 2019, 3:31 PM HAST.
-Type: (Pop up, banner top, Banner bottom) redirect in a new tab.
- Where you logged in to the forum: Yes
- Device and version: macOS High Sierra V.10.13.6
- Browser and version: Firefox V. 69.0.2
- URL of the ad:
https://pconly4test.thebigway2findcontent.info/rrr?b9zd1=EowosbzvyEEPt3mxxpVvBb3aUXz25Fl3GMX4ZYas8yk.&cid=205968992169374217&sub=[SUB_ID]
- Image location (if applicable):
- Screenshot(s) of the Ad/scam site:


____
This one was a bit questionable looks legit but it's confirmed with a quick Google search it's a scam site.
Site: http://friendlyforest.forumotion.com/
- Your country: USA
- Date and time when the ad appears: October 10, 2019, 8:37 PM HAST.
-Type: (Pop up, banner top, Banner bottom) redirect in a new tab. (There is a chance that it's actually those pop up/under ad appearing in the new tab. I need to look at the settings to see if I made a change that causing them to open in a new tab instead of normal behavior.)
- Where you logged in to the forum: Yes
- Device and version: macOS High Sierra V.10.13.6
- Browser and version: Firefox V. 69.0.2
- URL of the ad:
https://www.searchdefenderprime.com/t3ten?cid=206410978743558997&t1=2827263
- Image location (if applicable):
- Screenshot(s) of the Ad/scam site:

hello,

for information, the necessary has been done by our partner advertising agency and the situation should improve in the coming days

thank you

Still getting fake flash tabs/pop ads

-site: http://friendlyforest.forumotion.com/
- Your country: USA
- Date and time when the ad appears: October 14, 2019, 5:17 PM HAST.
-Type: (Pop up, banner top, Banner bottom) redirect/pop ad (opens in a new tab).
- Where you logged in to the forum: Yes
- Device and version: macOS High Sierra V.10.13.6
- Browser and version: Firefox V. 69.0.3
- URL of the ad:
http://24pccheck.thespaceofpages.info/?b9zd1=P5TdLnEqdW6Ec0FU88nmouHtWEZnPh9-9yTiqes3QdQ.&cid=w1veen5ks0160j2q1ui5pod4&sid=1aa29b5c-5db1-477e-ac49-d5bec14266665ddd6de0-7812-4e2d-9bf6-ba2c33d4ae9e963c587a-595a-43b7-8260-231f7d040040
- Image location (if applicable):
- Screenshot(s) of the Ad/scam site:

Comments:
Just to emphasize. I can tell that the above site is a fake/scam/phishing site. Here's the real site info.
As you can see the real site says the player is at the latest version.

Oh the old flash popup.  I have seen that one on many different sites and forums.  I just close the tab for it and  go on my way.  It appears a lot on sites that host videos and online games.

Still, that's unacceptable for me. Someone that doesn't know better could fall for the fake flash scam site trickery just like the notification ones. Hence, why I added the real site showing that the flash is currently on the correct version and the scam site is deception and fake site.

after 5 days i still receiving the malicious pop-up window

It appears it seems to be severe midnight or some other rest as a Scam flash ad happens again. It is alarming, and very distracting, as I was in the middle of updating some info and suddenly I have to turn my attention to reporting the scam ad instead. This one is worse than the last one. As I had almost taught that it had managed to infect and somewhat freeze my computer just by popping up due to all those fake dialogue boxes.

-site: http://friendlyforest.forumotion.com/
- Your country: USA
- Date and time when the ad appears: October 14, 2019, 11:01 PM HAST.
-Type: (Pop up, banner top, Banner bottom) redirect/pop ad (opens in a new tab).
- Where you logged in to the forum: Yes
- Device and version: macOS High Sierra V.10.13.6
- Browser and version: Firefox V. 69.0.3
- URL of the ad:
https://checkupdate.thespaceofpages.info/?b9zd1=aFDEo1W3qcjpym4Vud7AWjxq5TSBvQ8LDzjFhQ9_9uQeq8LMZs6xcQcIuTU-erd124NpHTyHzupK51jKFaXEqw..&cid=wemo5p938kcfgo2qhvlls938&sid=1aa29b5c-5db1-477e-ac49-d5bec1426666
- Image location (if applicable):
- Screenshot(s) of the Ad/scam site:

Comments:
Also, I noticed this the last few times that it's actually redirecting a few times before landing on the above scam and page and URL.

Code:

Here the order, it's still in the browser's history:
https://deloplen.com/?rb=SC9LbUrKyeEg7dYY6kqioQyPRvM4LlAG7VCw0rp7X8i1Vqp1ablPqizpM4kkJBwjU5RTJzTDyMlJLrPbKxIrnWNLoD7VWiJc6IhA8U17mLx8U7H1NkuskBXVWekDUmGeAosS3Mf5Lh26zn9i46pFG66NB4lUfUwYukBEgbAgnzdQvdJx03ipytbqRCcMQgCmhyXhPang6OvIsyinmsfbeztVvHh7Kr8JpplxGbxueyWLXHSzbWgJPlQ49FOjRCorXftVU78vM-YW4AzxGZy1j7Svkz2JTBnx&zoneid=2827263&fs=1&cf=1&sw=1440&sh=900&sah=877&wx=0&wy=23&ww=1314&wh=872&cw=1299&wiw=1314&wih=764&wfc=8&pl=https%3A%2F%2Ffriendlyforest.rpg-board.net%2Ft31-dragongirl-s-dragons%2349&drf=https%3A%2F%2Ffriendlyforest.rpg-board.net%2Fpost&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&fps=0
Redericts to
https://deloplen.com/afu.php?zoneid=1407888&var=2827263
Redirects to
https://fast.115redirect.com/1aa29b5c-5db1-477e-ac49-d5bec1426666?zoneid=2827263&lp=1&visitor_id=207895234200216443
Redirects to
https://fast.115redirect.com/redirect?target=BASE64aHR0cHM6Ly9zb2ZpNTA3LmFkbWVkaXQubmV0L2FkdmVydGlzZS8_YWRvd249ODg1MSZjbXA9NDI4MSZjdHJhY2s9d2VtbzVwOTM4a2NmZ28ycWh2bGxzOTM4JnB0cmFjaz0xYWEyOWI1Yy01ZGIxLTQ3N2UtYWM0OS1kNWJlYzE0MjY2NjY&ts=1571129615359&hash=Ombph983ejYAKFZ4cSYcleS4lZxVYr1BARnbW3HuPsU&rm=D
Redirects to
the main abve scam site and url.

Yuck! geeting a bit queasy from seeing the same scam over and over, lucky I haven't etean luch yet.

-site: http://friendlyforest.forumotion.com/
- Your country: USA
- Date and time when the ad appears: October 14, 2019, 11:01 PM HAST.
-Type: (Pop up, banner top, Banner bottom) redirect/pop ad (opens in a new tab).
- Where you logged in to the forum: Yes
- Device and version: macOS High Sierra V.10.13.6
- Browser and version: Firefox V. 69.0.3
- URL of the ad:

Code:

-site: http://friendlyforest.forumotion.com/
- Your country: USA
- Date and time when the ad appears: October 15, 2019, 12:09 PM HAST.
-Type: (Pop up, banner top, Banner bottom) redirect/pop ad (opens in a new tab).
- Where you logged in to the forum: Yes
- Device and version: macOS High Sierra V.10.13.6
- Browser and version: Firefox V. 69.0.3
- URL of the ad:
https://finishedupdate.yourworldofpage.info/?b9zd1=vZ6VwEf9Pc3sQWNRyAfUWOhU1KHHeyfrGIECG1qn4YQ.&cid=w0i30c75pfnf463q1nfiea2i&sid=1aa29b5c-5db1-477e-ac49-d5bec1426666
- Image location (if applicable):
- Screenshot(s) of the Ad/scam site:

- Image location (if applicable):
- Screenshot(s) of the Ad/scam site:



Another one in the same day figured I usally get two or more scam ads :
site: http://friendlyforest.forumotion.com/
- Your country: USA
- Date and time when the ad appears: October 15, 2019, 8:34 PM HAST.
-Type: (Pop up, banner top, Banner bottom) redirect/pop ad (opens in a new tab) and forces focuse on it (all have done that).
- Where you logged in to the forum: Yes
- Device and version: macOS High Sierra V.10.13.6
- Browser and version: Firefox V. 69.0.3
- URL of the ad:

Code:

https://workupgrade.thebestfreesiteforcontent.info/?b9zd1=YDcTGrO5uyqiyMWJEZbRoxYA5mU8WAhnhPYnV-70ReM.&cid=04119c10-efde-11e9-9454-9177f519e6c6&sid=85db6111

- Screenshot(s) of the Ad/scam site:

Commet:
I was moving stuff in post around when this pop up and force focused on that tab, deffintly distracting and then I have to turn my focuse once again on another report. Instead of doing what I should be doing.
Rederict urls:

Code:

https://deloplen.com/?rb=6vKNYdYdPGZqyK0fZEWNxopK33wi6sUui3eLby-sADS8uspjpbRTPp6u0fm2uanHoCHUz-MQF73s2mrFpQQ6GVsSwNDiq2wPXpgNDORPPGXigMxk4CsGXTDzKntcB3ViVvRKTTDzXEGq55492d6Xmj8U3ZeMG7YBxhMb9kOrlrfOpQk-XHkn2MDwhXzDfCN10PodNTymcTivzuBNsWYphz3-rcXzy6BWN9MR43f64TIdI3pBFeAAeI4fw5iyCyCQZhC2odD5D_pxMbzrXkgAowl11yv2JbHy&zoneid=2827263&fs=1&cf=1&sw=1440&sh=900&sah=877&wx=0&wy=24&ww=1314&wh=872&cw=1299&wiw=1314&wih=764&wfc=8&pl=https%3A%2F%2Ffriendlyforest.rpg-board.net%2Ft31-dragongirl-s-dragons%2347&drf=https%3A%2F%2Ffriendlyforest.rpg-board.net%2Fpost&np=1&pt=0&nb=1&ng=1&ix=0&nw=1&fps=0
https://deloplen.com/afu.php?zoneid=1407888&var=2827263
https://onandco.website/h/2te5r0Ban5H2WnOG0XM2z.dBdRZc4MPSDrfCM9bvIUdR0ck8MZpYYhw1f44ZvzWhcF56W0GcpeBNdQ5pqGPOjgiuLHo_5H89fHzI1cUBrgENBx_cKkRVCtG.7DXR5t5.fEhWErCCXmk8WmH5iiIOUZZshR76itNaBEjmbbtKzH6vQDFIrE0qf4Ow1jWWUwg2Sl0JV12cHljGigm4dxqlwQqq.qqqq.qq
https://workupgrade.thebestfreesiteforcontent.info/?b9zd1=YDcTGrO5uyqiyMWJEZbRoxYA5mU8WAhnhPYnV-70ReM.&cid=04119c10-efde-11e9-9454-9177f519e6c6&sid=85db6111

Just as I'm about to wrap up for the night this happens again, creating more stuff to do before wrapping up for the night:

-site: http://friendlyforest.forumotion.com/
- Your country: USA
- Date and time when the ad appears: October 16, 2019, 10:36 PM HAST.
-Type: (Pop up, banner top, Banner bottom) redirect/pop ad (opens in a new tab) and force focuses.
- Where you logged in to the forum: Yes
- Device and version: macOS High Sierra V.10.13.6
- Browser and version: Firefox V. 69.0.3
- URL of the ad:
https://upgradepc.thebigway2findcontent.info/rrr?b9zd1=bi7jtmxhOveCLT0n__ZiRwZT5f06O1b_fYGcJJLiiFk.&cid=208613968032314291&sub=[SUB_ID]
- Image location (if applicable):
- Screenshot(s) of the Ad/scam site:

Hello,

We have paused this ad format for now. The partner seems to be unable to completely disable this type of malicious content

We will have to replace with another advertising format. Indeed, this format was remunerated and allowed not to impact the active forums. Nevertheless, there will no longer be these security issues.

I guess the situation is definitely better on your side now?

thank you
i still get the same malicious pop up , i tested now https://keeponblogging.forumgreek.com
i am aware that my forum has no activity at the moment but every page i visit i get the same pop up 

've been working on Markdown Monster for a while now. It's a standalone desktop application and in recent months I've been plagued with Anti-Virus false positives for the installation executable. I didn't realize anything was wrong at first, until a few occasional emails came rolling in from users telling me their anti-virus flagged the installer dgcustomerfirst

Rory63 wrote:'ve been working on Markdown Monster for a while now. It's a standalone desktop application and in recent months I've been plagued with Anti-Virus false positives for the installation executable. I didn't realize anything was wrong at first, until a few occasional emails came rolling in from users telling me their anti-virus flagged the installer.

Is this related to a Forumotion forum?